Concerning the desktop, I honestly don't see Windows users caring much about non-native UIs. Windows apps to this day are a hodgepodge of custom UIs. From driver utilities to everyday programs, there's little an average Windows user would identify as a "Windows UI". And even if, deviations are commonplace and accepted.
Linux of course doesn't have any standard toolkit, just two dominant ones. There's no real expectation of "looking native" here, either.
Which leaves macOS. And even there, the amount of users really caring about native UIs are a (loud and very present online) minority.
So really, on the Desktop, the only ones holding up true cross-platform UIs are a subset of Mac users.
During my days of Windows-exclusive computing, I wondered what people meant by native UIs, and why do they care about them. My wondering stopped when I discovered Mac OS and, to a lesser extent, Ubuntu (especially in the Unity days). Windows, with its lack of visual consistency, looked like a hot mess compared to the aforementioned platforms.
And now that I think about it, would this made it easier, even by an infinitesimal amount, for malware to fool users, as small deviations in UI would fail to stand out?
I don't know exactly what time period you're referring to, but back when Java was attempting to take over the desktop UI world with Swing, it was painfully obvious when an app wasn't native on Windows. Eclipse was the first Java app I used that actually felt native, thanks to its use of native widgets (through a library called SWT) instead of Swing.
As far as I know, you can even write your own applications based on SWT which would make jvm apps pretty consistent and performant across platforms, but not many people seem to have chosen that route for some reason.
> And now that I think about it, would this made it easier, even by an infinitesimal amount, for malware to fool users, as small deviations in UI would fail to stand out?
I don't think that's how fraud works in actuality; malicious actors will pay more attention to UI consistency than non-malicious actors (who are just trying to write a useful program and not trying to sucker anyone), inverting that signal.
I don't know, I've read that e.g. spam will not focus on grammatical accuracy because they want to exclude anyone who pays attention to details. Also most fake Windows UIs from malicious websites I used to see weren't exact matches of the native UI.
Linux of course doesn't have any standard toolkit, just two dominant ones. There's no real expectation of "looking native" here, either.
Which leaves macOS. And even there, the amount of users really caring about native UIs are a (loud and very present online) minority.
So really, on the Desktop, the only ones holding up true cross-platform UIs are a subset of Mac users.